The Saint James Hospital Group
incransom listed this organization on its leak site on May 1, 2025.
- Listing date
- May 1, 2025
- Attack date
- Apr 30, 2025
Listing text
At Saint James Hospital Group, they have over 25 years of experience in the healthcare sector. It has earned a reputation for excellence and innovation, backed by the latest state-of-the-art technology and staffed by highly-qualified professional personnel. They are the natural choice when seeking private medical treatment, not simply because they have the experience to meet your expectations, but also because they house the very best in modern technology – and the island’s most renowned consultants and health professionals. The Saint James Hospital Group became a victim of the data breach. 250Gb sensitive, medical and personal data will be published soon in our blog.
About the group
incransom posted its first listing on Aug 9, 2023 and has listed 1,017 organizations to date.
INC Ransom is a prolific ransomware-as-a-service operation active since July 2023 that systematically targets healthcare, government, education, and manufacturing sectors in North America and Europe, having posted over 200 victims in 2025 alone with no sector off-limits.
Learning center
What does this listing mean?
Ransomware groups move data out of the organization before encrypting systems and threaten to publish it if the ransom is not paid. This method is called double extortion.
The listing shows that the group claims to have targeted the organization. Whether the data was published is shown by the later status of the listing.
What should you do if your organization is listed on a leak site?
- Record the listing and any published sample files; do not visit the leak site from the corporate network.
- Isolate affected systems and preserve logs without deleting them.
- Determine which data left the organization; if personal data is involved, review notification obligations with your legal team.
- Make any decision about the ransom demand together with legal, management and incident response.
- Do not bring systems back online before the attacker’s entry point is closed.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainIntelligence 360
Customer intelligence on top of Infostealer Detection: leaked accounts of end users who sign in to your site.